// For flags

CVE-2024-6959

Denial of Service (DOS) in multipart boundary while uploading file in parisneo/lollms-webui

Severity Score

7.1
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

A vulnerability in parisneo/lollms-webui version 9.8 allows for a Denial of Service (DOS) attack when uploading an audio file. If an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously process each character, rendering lollms-webui inaccessible. This issue is exacerbated by the lack of Cross-Site Request Forgery (CSRF) protection, enabling remote exploitation. The vulnerability leads to service disruption, resource exhaustion, and extended downtime.

Una vulnerabilidad en la versión 9.8 de parisneo/lollms-webui permite un ataque de denegación de servicio (DOS) al cargar un archivo de audio. Si un atacante agrega una gran cantidad de caracteres al final de un límite de varias partes, el sistema procesará continuamente cada carácter, lo que hará que lollms-webui sea inaccesible. Este problema se ve agravado por la falta de protección contra Cross-Site Request Forgery (CSRF), lo que permite la explotación remota. La vulnerabilidad provoca la interrupción del servicio, el agotamiento de los recursos y un tiempo de inactividad prolongado.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
Poc
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-07-20 CVE Reserved
  • 2024-10-13 CVE Published
  • 2024-11-03 CVE Updated
  • 2025-07-09 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-352: Cross-Site Request Forgery (CSRF)
  • CWE-400: Uncontrolled Resource Consumption
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Lollms
Search vendor "Lollms"
 Lollms Web Ui
Search vendor "Lollms" for product "Lollms Web Ui"
*-
Affected
Parisneo
Search vendor "Parisneo"
 Lollms-webui
Search vendor "Parisneo" for product "Lollms-webui"
*-
Affected